European Union
Device law, data privacy, and hosting tier for European Union, on one page.
Device law
Full sectionStructurally the worst place to be misclassified. Under MDR, any software with a medical purpose is a device, and Rule 11 is severity-based, so almost no standalone medical-purpose software stays Class I. The AI Act stacks on top: medical-device AI is high-risk, and a compliant product must satisfy both MDR and the AI Act. The Digital Omnibus package agreed in late 2025 pushes the AI Act compliance dates back: standalone high-risk AI to 2 December 2027, and AI embedded in MDR or IVDR devices to 2 August 2028. Rule-based software with no learning component is not covered by the AI Act at all.
The neutral knowledge layer relies on the intended purpose too generic line. Education that does not act on an individual's data is not a device.
A symptom-interpreting agent is both a device (likely IIa+) and a high-risk AI system, triggering dual conformity assessment.
Keep public-facing decision logic deterministic and rules-based. The funnel never needed clinical reasoning, so the moat and the regulatory firewall are the same wall.
Data privacy
Full sectionHealth data is special-category data under Article 9, so processing needs both an Article 6 lawful basis and an Article 9 condition, usually explicit consent in this context. Large-scale processing of health data triggers a Data Protection Impact Assessment under Article 35. Acting for a clinic makes us a processor, requiring Article 28 terms. Transfers outside the EEA need an adequacy decision or appropriate safeguards such as Standard Contractual Clauses. Breaches are notifiable within 72 hours, and fines reach 4 percent of global turnover.
Explicit consent, a DPIA, a signed processing agreement with each clinic, and EU-region inference or SCC-backed transfer. The cleanest path is to keep processing in an EU region.
Hosting tier
Full sectionAccountability or transfer-gated. Australia, EU, UK
External APIs are usable only if data stays in-region through a regional endpoint, or is covered by a transfer mechanism (SCCs, the UK IDTA) plus consent. The cleanest path is in-region managed inference, Vertex in australia-southeast1 for Australia, an EU region for the EU and UK, or self-hosting. Australia's APP 8 specifically rewards keeping data onshore.